If I look at the log it says it cannot retrieve information from:
database.clamav.net
If I try to open that site in a browser I can not reach it, nor can I ping to it.

My questions:
1. Can you reach that site? Hence is the site down, or are it my settings.?
2. Is there an alternative for this mirror? I have found a form in ClamWin where I can specify the virus update download site. If there is a working mirror, I can change that and try again.

GuitarBob

Joined: 09 Jul 2006

Posts: 4392

Location: USA

Posted: Sun May 17, 2015 11:03 am

I have the same problem sometimes--think it is just the mirror(s). I can usually update later.

Regards,

ROCKNROLLKID

Joined: 23 Sep 2013

Posts: 562

Location: **UNKNOWN**

Posted: Sun May 17, 2015 4:52 pm

ClamWin/ClamAV should automatically switch between mirrors if one fails. As Bob said, wait a little awhile and it should work eventually.

Marc W2

Joined: 14 Nov 2013

Posts: 22

Posted: Mon May 18, 2015 5:01 pm

Thank you. I will wait a few days.

I got it after an update from 0.98.6 to 0.98.7.
I presume it has nothing to do with that?
It is an old W2000 system.

GuitarBob

Joined: 09 Jul 2006

Posts: 4392

Location: USA

Posted: Mon May 18, 2015 5:09 pm

ClamWin should normally get a couple of signature updates from the Clam AV project every day. On rare occasions, however, the Clam AV sigmakers have not developed any signatures for a few days or there can be a problem with the virus submission interface (it's old and cranky!). Most ClamWin users are probably not going to get the latest/greatest malware, so we are still fairly safe on these occasions.

Yes. I would check your firewall and make sure nothing is blocking ClamWin/ClamAV. If you use another Anti-virus, make sure you add an exception to the ClamWin directory.

Marc W2

Joined: 14 Nov 2013

Posts: 22

Posted: Sat May 30, 2015 1:00 pm

Trying older versions did not work.

If it is the firewall, then this would be strange since I did not change any settings and I could download before.

Can you download the database by hand somewhere?

Marc W2

Joined: 14 Nov 2013

Posts: 22

Posted: Sat May 30, 2015 1:21 pm

Actually I cannot reach any *.clamav.net somehow.

I am searching, trying to find a solution to this problem, and some answers are for example on www.clamav.net/doc/mirrors-how-to, and opening it with FF gives Server not found. Firefox can't find the server at www.clamav.net. I could reach that location from my computer at work.

I have found out how to download the files by hand. I could do that from another location and then copy them to my W2000 computer.

(I use that computer for some old games. But if I cannot run any protection on it... from now on I won't use the internet anymore on that machine.)

ROCKNROLLKID

Joined: 23 Sep 2013

Posts: 562

Location: **UNKNOWN**

Posted: Sat May 30, 2015 2:59 pm

Because ClamWin only runs off the ClamAV engine, this issue is something we cannot fix. IF you want to download signatures manually, you can do that on their homepage under the download section. If you still need assistance, I would recommend contacting ClamAV support here: http://www.clamav.net/contact.html

Any issues with the engine or database is something ClamWin cannot fix.

Marc W2

Joined: 14 Nov 2013

Posts: 22

Posted: Sat May 30, 2015 5:04 pm

I have done the following which is a bit of a kludge. But it works, and I am only using this old W2000 now and then.

I have another Windows system with ClamWin.
That has no problems downloading the files
Then I copy the db to this machine by means of a thumb drive.
Then I scan.

And I think that worm prevents me to update my virus database.
I got it on the 11th of May. The last day I could update the db correctly.

And of course, I cannot connect to the Kapersky site that holds the exe to remove this annoyance. I think that definitely proofs it. I could not reach the update site because of a virus. The fact that I did an update just before, is sheer coincidence...

Thanks for your support.

Marc

GuitarBob

Joined: 09 Jul 2006

Posts: 4392

Location: USA

Posted: Sat May 30, 2015 8:45 pm

Kido is the old Conficker worm (Kido, Downadup, Conficker), which was spread by USB originally. Do a web search for Conficker removal tools. There used to be several AVs that had removal tools for it. If ClamWin can detect it but not remove it, try a scan in Windows safe mode. There may also be one or more registry entries that you will have to manually remove.

Malwareybtes free should remove it if you can run it on the machine--it will run in safe mode also. Other removal tools: Dr. Web's Cureit or maybe Trend Micro's Housecall.